What is CVE-2021-25646?
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 2098 days ago.
Severity and exploitation probability
- EPSS (FIRST)
- 99.0% probability of exploitation in the next 30 days, higher than 99.9% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2021-01-29, last modified 2025-02-13
Is CVE-2021-25646 being exploited?
Weaponised exploit code for CVE-2021-25646 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2021/CVE-2021-25646.yaml). It currently carries a trending score of 40 in the Threadlinqs vulnerability feed.
- 1n7erface/PocList (github)
- yaunsky/cve-2021-25646 (github)
- j2ekim/CVE-2021-25646 (github)
- k7pro/CVE-2021-25646-exp (github)
- Vulnmachines/Apache-Druid-CVE-2021-25646 (github)
- givemefivw/CVE-2021-25646 (github)
- lp008/CVE-2021-25646 (github)
- Ormicron/CVE-2021-25646-GUI (github)
Affected products and versions
- Apache Software Foundation: Apache Druid
How to fix CVE-2021-25646
No vendor patch reference has been recorded for CVE-2021-25646 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2021-25646
1 tracked threat in the Threadlinqs corpus references CVE-2021-25646, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on .
Mailing list and disclosure
- openwall.com — mailing list
- lists.apache.org — mailing list
- lists.apache.org — mailing list (rc167d5e57f3120578718a7a458ce3e73b3830ac)
- lists.apache.org — mailing list (r20e0c3b10ae2c05a3aad40f1476713c45bdefc3)
- lists.apache.org — mailing list (r4f84b542417ea46202867c0a8b3eaf3b4cfed30)
Other references
Showing 7 of 16 recorded references.